How to Check Whether Your WordPress Site Is Running a Vulnerable Version

Check the WordPress core version in Tools > Site Health > Info, then compare it with WordPress.org’s current support guidance and the advisory for any specific flaw you are investigating. An older version is a reason to check and update—not proof that a particular vulnerability affects your site. Also review plugins and themes, which have their own versions and security advisories.

1. Find your WordPress core version

1. Sign in to your WordPress admin dashboard.
2. Open Tools > Site Health > Info.
3. Expand the WordPress section and note the value beside Version.

Site Health’s Info screen reports technical details; it does not install updates. To check for or apply an available core update, open Dashboard > Updates. WordPress.org documents the Site Health information screen and the WordPress Updates screen.

#	Preview	Product	Price
1		AMBIR ID Card Scanner with Software -PS667 - Automatic Data Extraction for Age Verification, No...	$229.95	Buy on Amazon

As an Amazon Associate I earn from qualifying purchases.

2. Check whether that version is supported

Compare the version you recorded with WordPress.org’s Supported Versions guidance. WordPress.org says the latest major release is the only version currently officially supported. Older branches may receive security fixes as a courtesy, but there is no guaranteed backport schedule or fixed long-term-support period. Do not assume an older branch will continue receiving fixes.

Release status changes over time. As of October 7, 2026, WordPress.org’s security page listed WordPress 7.1.3, announced October 6, as a maintenance and security release containing seven security fixes and four bug fixes, and recommended updating. Check the current WordPress security and release notices rather than relying on that dated version number as a permanent benchmark.

#1 Best Overall

AMBIR ID Card Scanner with Software -PS667 - Automatic Data Extraction for Age Verification, No Subscription One Time Purchase

• Complete Turnkey Solution – Hardware and software included in a single purchase with no subscription fees or ongoing costs. Everything your small business needs to start scanning IDs professionally right out of the box.
• Verification Mode – Keeps No Customer Data – Includes a Verification only mode where you can get an instant APPROVED / UNDER AGE / EXPIRED verdict, then the ID data is discarded—nothing saved. A verification log (date, time, register, clerk, result) is your record that a check was performed. Export verification report via CSV file. Ideal for beer, wine, tobacco, and lottery sales.
• Local Data Storage – All scanned information is stored locally on your system, giving you maximum privacy, security, and control without requiring cloud storage or internet connectivity.
• USB-Powered Simplicity – Plug the scanner into your PC and you're ready to go. No external power supply needed, no complicated setup. Windows and Mac compatible.
• Built-In Age Verification – Set customizable age restrictions to automatically flag minors and prevent them from purchasing age-restricted items. Includes expired ID detection to catch invalid credentials.

$229.95

Buy on Amazon

3. Verify whether a specific vulnerability applies

To determine whether a named flaw affects your site, identify the exact component and vulnerability, then compare your installed version with the affected and fixed ranges in the relevant official release notice or authoritative component advisory. Read any stated prerequisites, such as a particular configuration or companion software. A release may address only certain branches or circumstances; being behind the newest release does not by itself establish that your site is affected.

• Component: Is the issue in WordPress core, a plugin, or a theme?
• Affected range: Does the advisory include the version you have installed?
• Fix: Which version contains the correction, and is it available for your branch?
• Conditions: Does the advisory require a particular configuration or setup?

For example, WordPress.org’s October 6, 2026 announcement for 7.1.3 describes that release’s security fixes and advises sites to update; it is not a universal list of every version affected by every WordPress vulnerability. Use the specific notice to establish applicability.

4. Check plugins and themes separately

A core version check cannot establish whether every installed plugin or theme is secure. Open Dashboard > Updates to review available plugin and theme updates. The Plugins and Appearance > Themes screens also show installed components and available updates. For a technical inventory, return to Tools > Site Health > Info and expand the relevant plugin or theme sections. WordPress.org explains plugin updates and theme updates.

If a particular plugin or theme is in question, check its current official security notice or an authoritative vulnerability record, and match the installed version to that notice’s affected and fixed ranges. Treat a scanner alert as a prompt to verify the component and advisory, not as a substitute for determining applicability.

5. Update outdated software safely

1. Review Dashboard > Updates and select the relevant core, plugin, or theme update. WordPress.org also provides the official WordPress download.
2. Before manually updating plugins, make a current backup of the site. WordPress.org advises keeping backups current because update problems can occur.
3. Apply available updates using the dashboard or official download and follow any component-specific instructions.
4. Afterward, confirm the installed version in Site Health Info or the relevant plugin or theme screen, then test the site’s important pages and functions.

WordPress.org describes automatic background updates for supported sites; availability and behavior can depend on the site’s setup. Consult its automatic background updates guidance and current release notices when deciding how to keep a site current.

What dated release figures can—and cannot—tell you

WordPress.org reported 11 security fixes in WordPress 7.1.1, announced September 17, 2026. That and the seven fixes in 7.1.3 are release-specific counts, not a measure of the risk to an individual installation. Likewise, Wordfence’s 2024 Annual WordPress Security Report said 96% of the vulnerable software types analyzed were WordPress plugins. That is a vendor-reported statistic about its analysis, not a probability that a particular site has a vulnerable plugin. Wordfence describes scanner alerts for unpatched vulnerable plugins in its 2024 report; verify any alert against the component’s relevant advisory.

Quick Recap

Bestseller No. 1

AMBIR ID Card Scanner with Software -PS667 - Automatic Data Extraction for Age Verification, No Subscription One Time Purchase

$229.95

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.